Some field mapping in .fleet-agents index are unused

[jen-huang]

In mappings for .fleet-agents index, it seems like not all fields we define are actually used when ES documents are written with agent information. For example the mappings define fields like agent, packages, last_updated (updated_at is used, however), last_checkin_status, but they don't appear on the ES documents.

Can we do an audit and get rid of unnecessary mappings?

Currently the UX impact is that these unused fields are showing up in the autocomplete search bar in Kibana: elastic/kibana#100391 (comment)

      {
        "_index" : ".fleet-agents-7",
        "_id" : "4828a373-aacd-468f-b2dc-54f9716a12cc",
        "_score" : 1.0,
        "_source" : {
          "access_api_key_id" : "i_vdn3kBf4nStuEi_24o",
          "action_seq_no" : [
            -1
          ],
          "active" : true,
          "enrolled_at" : "2021-05-24T19:33:16Z",
          "local_metadata" : {
            "elastic" : {
              "agent" : {
                "build.original" : "7.13.0 (build: 054e224d226b42a1dd7c72dcf48c3f18de452e22 at 2021-05-20 00:57:28 +0000 UTC)",
                "id" : "4828a373-aacd-468f-b2dc-54f9716a12cc",
                "log_level" : "info",
                "snapshot" : false,
                "upgradeable" : false,
                "version" : "7.13.0"
              }
            },
            "host" : {
              "architecture" : "x86_64",
              "hostname" : "Jens-MacBook-Pro-New.local",
              "id" : "B195D4F0-56DE-54F2-8F59-F6B395FCAFD2",
              "ip" : [
                "127.0.0.1/8",
                "::1/128",
                "fe80::1/64",
                "fe80::aede:48ff:fe00:1122/64",
                "fe80::4a:8812:e5d4:48ac/64",
                "10.0.0.205/24",
                "2601:601:8180:4670:cf:9c75:9461:eba2/64",
                "2601:601:8180:4670:748c:88ea:5e94:7c2f/64",
                "2601:601:8180:4670::b887/64",
                "fe80::2c26:17ff:fe3d:6cce/64",
                "fe80::2c26:17ff:fe3d:6cce/64",
                "fe80::f31a:eb67:b877:7ce7/64",
                "fe80::7460:d809:594c:e8df/64",
                "fe80::4469:c91:40af:b8f5/64",
                "fe80::f3a8:7236:e7b0:f645/64"
              ],
              "mac" : [
                "ac:de:48:00:11:22",
                "36:7d:da:a4:a3:f7",
                "14:7d:da:a4:a3:f7",
                "06:7d:da:a4:a3:f7",
                "2e:26:17:3d:6c:ce",
                "2e:26:17:3d:6c:ce",
                "82:14:17:89:c4:01",
                "82:14:17:89:c4:00",
                "82:14:17:89:c4:05",
                "82:14:17:89:c4:04",
                "82:14:17:89:c4:01"
              ],
              "name" : "Jens-MacBook-Pro-New.local"
            },
            "os" : {
              "family" : "darwin",
              "full" : "Mac OS X(10.15.7)",
              "kernel" : "19.6.0",
              "name" : "Mac OS X",
              "platform" : "darwin",
              "version" : "10.15.7"
            }
          },
          "policy_id" : "9f4ee570-bcc1-11eb-9026-93809ebcd6a3",
          "type" : "PERMANENT",
          "default_api_key" : "jfven3kBf4nStuEiQm7Z:B8RCQ56PQw6ivGBImaBODw",
          "policy_output_permissions_hash" : "81b3d070dddec145fafcbdfb6f22888495a12edc31881f6b0511fa10de66daa7",
          "default_api_key_id" : "jfven3kBf4nStuEiQm7Z",
          "policy_revision_idx" : 4,
          "policy_coordinator_idx" : 1,
          "updated_at" : "2021-05-24T19:44:25Z",
          "last_checkin" : "2021-05-24T19:44:19Z"
        }
      }

[scunningham]

last_checkin_status add with this PR: #420

[jfsiii]

I believe last_checkin_status was accidental omission. It is used in AgentService.getAgentStatus which is used in the Agent list and detail views, as well as a few agent API endpoints.

I found the bug while working elastic/kibana#76841 and last_checkin_status was restored in #420

[jlind23]

Closing this one as outdated, we will reopen it later if required.
cc @ycombinator